CVE-2014-6704

CVE-2014-6704 describes a critical vulnerability in version 2.0.0 of the Utah Jazz Android application, developed by Sporting Innovations. This flaw stems from the application's failure to properly validate X.509 certificates from SSL servers, making it susceptible to man-in-the-middle (MitM) attacks. An attacker could exploit this by spoofing legitimate servers with a crafted certificate, thereby intercepting and potentially compromising sensitive user information. The vulnerability carries a CVSS score of 5.4, indicating a medium severity. Its attack vector is adjacent network (AV:A), meaning an attacker needs to be on the same local network as the victim. The attack complexity is medium (AC:M), and it requires no authentication (Au:N). The potential impact includes partial compromise of confidentiality, integrity, and availability (C:P/I:P/A:P). Currently, there is no evidence of active exploitation for CVE-2014-6704, and no public exploit code is available on platforms like Metasploit or ExploitDB. The vulnerability has also garnered minimal community discussion or media coverage, suggesting a low level of public awareness or concern.